Setup and configuration - Google, GitHub, and Facebook

What this integration does

Social login lets people sign in to DockRay through Google, GitHub or Facebook instead of a password - free, for every account. A provider's button appears on the login and registration screens only when that provider has a complete set of OAuth keys in the panel and is switched on. A disabled or unconfigured provider answers 404, not 403 - an address nobody has announced has no reason to reveal that it would work once the keys are filled in.

Who configures the providers

OAuth keys are entered only by Dock's superadmin, in the platform settings - a global setting shared by every account, the same as the Stripe keys. Subscribers never see this screen and cannot plug in their own OAuth application.

What to prepare with the provider

For each provider you want to enable, create an OAuth application in its developer console (Google Cloud Console, GitHub developer settings, Meta for Developers) and generate a Client ID / Client Secret pair. The DockRay panel computes and shows a ready-to-copy redirect address for each provider - paste it exactly into the Redirect URI field in the provider's console. A mismatch between that address and what the application actually handles is the most common reason a given provider's login does not work.

Turning it on in the panel

In Platform settings, paste the provider's Client ID and Client Secret and switch it on. The secret is encrypted and never returns to the form once saved - a blank field on the next edit means 'keep the current secret', not 'clear it'. A provider becomes visible on the login screen only once its switch is on and both keys are set - one without the other is not enough.

Login and return addresses

For every provider DockRay exposes a predictable pair of routes:

/auth/{provider}           redirect to the provider
/auth/{provider}/callback  return and finish the login

It is exactly that callback address, computed for the current environment (production or staging), that the panel shows ready to paste into the provider's console - there is no need to assemble it by hand or guess the scheme.

The first test

Open the login screen in a private window and check that the enabled provider's button is visible. Sign in with it on a test account - you should come back to the panel logged in, and if the account requires two-factor verification you should be asked for it, exactly as with a password login.